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FIGURE 1 



!^ 1 -, At ®^^*f ds * ^*«=a«k W using key JC to her object OtomafceCT.AtOBobatealsa 
HI £ <*S£ ^l^ raCtS *■ ******* O' «mff tfa* key JC to ahow that ^ i oJSfni 

it for^^feM-?" ^^'Ij^^^'vil^ *a ^j^*^*'^ wateoBiaxis. At (§) Bob distorts O' (and IV) mati^ 

?^,rtT^ completely orgefaa distorted watermark. At ® Alice adds tampcprcofing T to 
C^A* ® Bob tees to remove W feom O, but, d*e to the tampecprocfc*, OrflbeSSIS 
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CONST C 



'Copyright: <C)...« 






chax T; 
switch, e { 










case 1 ; 


y 




»C» 




case 5 : 


V 




>Q> 




case' 6 : 


V 




>P» 




case 8 : 


7 




* Y > 




case 9 : 




S3* 






> 






-j 



if Input =*=» X { 




posh. 'C 

• * • • 

push. *0* 
push. *P* 

posh. *Y* 
push. *R> 



if Input — X 

DisplayCTeamPic) 



J 




FIGURE 2 



Figure 2: In® Alice ffmherfa a waUn marie in the ™rci*?i*H[ data (string) section of Iter program. In© the 
WAU*-iriark is embedded in the text (code) section of the p p' fc™^ la © the watezsxazk gets embedded in a 
global variable V when the uiuty am is run with input X. In ® the watermark is embedded in the eu e ciiti on 
trace when the program is m with inpnt X. In @ the watermark is *~nfo~AA*** in the unexpected behavior 
(an ^Easter Egg° ) of the program when it is run with input X. 
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String- <i Ciat xO { 
ia* i=K),k; 
String S; 
rfixLe (1) { 

Liz ±± Cu— •!) {S Ei-wO = w A ff ;k=0 ; goto L6>; 

L2; if Cn=-=2) {S Ci++] ~ ff B ff ;ic=^2 ;goto L6}; 

L3: if (nr— 3) <S Ci++] -"C" ; goto L9} ; 

L4i if Cb=—4) {SCi-M-j^^X-jgoto LB}; 

LS: if Cn-=5) {SEi^KI^C^gcrto Lil}; 
if Cn>12) goto LI; 

L6; if Ck++<=»2) {SCi+^-^jgoto LS} else goto L8; 

L8 i return. S I . 

L9: SCi++3=•"C ,, ; goto L10; 

L10: SEi++3-"B n ; goto L8; 

Lll: SCi++3= w C w f goto L12; 

L12i goto L10; 

} 



FIGURE 5 

Figure 3: A function producing the the strings "AAA", "BAAAA*, W XC8", and "CCB". 
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Figure 4u Inserting bogos predicates in a program. In © an opaque predicate b > 5 T is inserted. This 
predicate is always true- In © an opaque predicate rand(Q, 9) < 5 7 is inserted. This predicate is sometimes 
trae (in widen case B is executed), and sometimes false (in which case an obfuscated « ™™ of B is 
esecnted). In © an opaque trae pr w tira te ia inserted* This predicate appears to sometimes exectrte an 
obfuscated buggy version of -S, but, in fact, never does* 
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bool A,B,C; 
8 « False; 
C » False; 
C - A ft B; 
C - A ft B; 
if CO •-.; 
if CB> 



CIO short al,a2,bl,b2,cl,c2; 
C20 bl»0; b2=0; 
C3') cl=l; c2=i; 

C4») x=ASDt2*ai+a2,2*bl-fb23j ci«x/2; c2»x%2; 
CS J ) cl-Cal " a2) ft Cbl * b2>; c2«0; 
C6») x=2*al+a2; if C<x-=1) II C*=-2)} ---; 
C7») if Cbl * b2> .-•; 



FIGURE 5 



Figure 5: Variable splitting eiA mri\e . We show one possible **^ i * it **^ o£ p **^ <M *i*n* i ^frrn for solxt boolean 
variables. The table indicates that boolean -variable V has been split into two short m^-pr r variables p 
and q. Hp = g = 0arp=gr = l then V is False, otherwise, V is True. Given, this new representation, 
tw devise subsLiluUons far the bmtt~in boolean operations. In the example, we provide a. ma- time lookup 
table for each operator. Given two boolean variables V\ = [p, q] and Vi = [r, «], r V\&.V-p is camp used as 
r lHD(2» + g, 2r + «f . 



Z(X + r,Y) = 2»-Y + (r + X) « Z(X,Y)+r 

Z(X,Y+r) = 2 a3 -(Y + r) + X = Z(X,Y)+r.2 3a 

Z(X.r,Y) = ^-Y+Xr = Z(X,Y) + (r-l) -X 

Z(X,Y.r) w. 2«-Y.r+X = Z(X,Y) -j-(r- 1) -2P Y 

<lO long Z~16775908611955104S; 

C20 Z +- 6; 
C3') Z 4« 47244640256; 
C40 Z +- Cc-l)*CZ ft 4294967296) ; 
CSO Z += (d-l)»C2 ft 18446744069414684320); 

FIGURE 6 



Cl> 


iart X=45; 




in* Y=95; 


C23 


X -H. 5; 


C3) 


Y +- 11; 


C4) 


X *- c; 


C5) 


Y *- d; 



Fignre 6: Merging two 32-bit variables X and T into one 64-bit variable Z. Y occupies the tap 32 bits af Z, 
X tie bottom 32 bits. If the actual range of either X or T can be deduced from the program, less intuitive 
merges could be used- First we give rules for addffrirm and Tnohrmliratfnn with. X and Y, then show some 
S i mple examples. 
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is* SoaClart AO) { 
izxb i t bwbpQz 
irrt bf=A« length.; 
far <i-0;i<a;±++) 

ffxnn -H* ADJ ; 
ret mxt sxm; 

} 



iat SuaCiat AD) { 

±zrt sum^O, ±="0, pc*«0; 

±fft s □^naw ixttCS], sp— 1; 

loop : yhile Cfcroe) 

sntch("f cgabced*»char&&(pc)) { 

case J a* : sua += stsp — 3; pc++; break; 
pc-H-; break; 
st+*spl = i; pc++; break; 
if CsCsp — 3 > sEsp — 3) pc — 6; 
else break loop; break; 
s D > ap l » A-length; pc*+; break; 
pc *<= 5; break; 
sCsp3 =■ ACstsp33; pc++; break; 



case *b* : 



case 



> 

xelursL 



c • 
case J d' : 

case 'e*: 
case *f * : 
case *g J s 



FIGURE 7 



Figure 7: The Java method Sam aa the left is obfuscated by *r»™i n *™ g ft into the bytecode *f cgabced". 
This code is then executed fay a stack-based interprets *f» **' " *?Wffl ij XO tmrtAlm lfavt r%^rtirrr^\A'r ^r^n ^\ Twar4i^T*— 
code. Thia techxuqne is similar to Proebsttn^s im^ n ui^ i *i* >r<i |50]. 
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FIGURE 8 



Figure 8: At © Alice selects-two large primes P and Q % and computes their p ro d u ct ru At © ahe rnihtfrin 
n in the topology of a graph. This graph is her watermark W. At ® W is converted to a program which 
btnids the graph. At @ the program is embedded the orfgfnal program snch that when Oq is 
ran. with. X as input, W is "built - Also, a recognizer progr am 72- is constructed, which is able to identify 
oil the heap, and extract ft fkom xt. At (§) tamperpxoofing is added} to pi event the graph, ^ inrrt being 
obfuscated to sack an extent thai 7Z. cannot identify it. At © the application (mcimSng the watermark, 
tamperprocfizzg code, and recognizer) is obfuscated. At © the recognizer is removed ftum the appucackm. 
Oz is the vrr.niim of Alice's program that is distributed. At ® aw,***** links in the recognizer program /t» 
with At © the appfimtion is rxm wxthX as inpu t, and the recognizer 72. produces a. n******** is 

the only one who can factor n, he can prove the legal origin of Alice's program, 
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Z-6* + 26 s + 3-6 3 + 4-6 1 -4- 1 - 6° = 4453 = fil • 73 



FIGURE 9 



BnAeddmsawatetma^iiitoagraplistnictnie. The structure is esseotiaUy a Hnied list. The 
SS^/fT^ ""f the next field, while the second field encode a digit. In this exampU 

i i C ff^T 3 ^ »^ep back pointer, 3=^ one step forward pointer, 4=a two step bS 
EKMtte^d 5=a 2 s*^. forward poate. This allows us to encode a value 61 .73 = 4453„ as tiTbaseS 
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Figure 10: The twenty-second 
tkm of the oriented trees with. 



man 

'vertices. 
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Fignre lli A 5-dxqae is used to mad: the beginning of an ?alue. 
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class T { 
±sct &; 

■ T 
T 

} - 



class T { 
la± a; 
T car; 
T bogusl; 
.T cdr; 
T bogus2; 

} 



class T { 

±at a; 7T 
@ T car; — r* 

- T cdfcr; 

. > 



class T { 
T Fl; 
1st F2; 
TP3; 

> 



«s 43 



4? 



65 



v 43 



cm cc: #a X 



4f 



11: 


•4- 




Sfi 







33; 43 j 



13s 



£1 



© 



class T { 
ircfc a; 
T car; 
T cdr; 

> 

3x =■ nev T; 



class T { 
in* a; 
Tl bogus; 

} 

7^ class Tl { 
X cdr; 

} 

u « new T; 
n.bogns « nev Tl; 



-U-r 

*s BS 1 [em 4>4 > f*s 



caa-s 4»4> ^ 
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Figure 12: Q bfnac a tion of dynamic 
@ we rename and reorder firtris. Lx ® 



la © we add bogus pointer fields to all nodes of type T. In 
add a level of irriu e cli on by splitting all nodes in two. 
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class C {public xzrt a; public C car, cdr;} 

public static void main CStxingD args) { 
Fi«idQ F « C, class, getFieldsO ; 
±£ GMengti. !« 3} 

diaO; 
if CF£0] .ge«jpeO- 

java-lang. Integer «/TYFE) 

diaO; 

i* CFCU-getTypeO !*» C. class) 

if CFE23.gstTjpeO I- C. class) 
diaO; 



class C {public in* a; pnhlic C car, cdr;} 

public static void main (ScringO args) 

throws JoSurTiFiaTiTFTCBptictt, 

n 1 egalAccpiffKTr<*pt ion { 
Field f; 
String V; 
Ca» sav CQ ; * 
Class c =* a. gatClans O ; 
if CP**) { 

t =» c.g«tFi«ldCV eB ** nr *); 

© l.satCn, anil); 

} 

Field F - c.gHtFieldsO; 
±at E; 

@ FOtr 1 ] .ssrcGa, 21^ car) ; 

} 

(b) 
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Figure 13: Examples of taxnpexproafing Java code using; the reflection mtgrfacft. 
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